diff --git a/src/features/stores/hooks/useSites.ts b/src/features/stores/hooks/useSites.ts
index cda7b3e..0538eb9 100644
--- a/src/features/stores/hooks/useSites.ts
+++ b/src/features/stores/hooks/useSites.ts
@@ -1,6 +1,7 @@
 'use client';
 
 import {useResource} from '@/shared/hooks/useResource';
+import {useSession} from '@/features/auth/providers/SessionProvider';
 import {siteRepository} from '@/features/stores/repositories/siteRepository';
 import type {Site} from '@/features/stores/types/site';
 import type {Resource} from '@/shared/hooks/useResource';
@@ -11,7 +12,25 @@ import type {Resource} from '@/shared/hooks/useResource';
  * Unscoped on purpose — the site list is what the scope selector is FOR, so it
  * cannot itself be filtered by the selection. That also means one fetch per
  * session rather than one per store change.
+ *
+ * ── Why the session gate lives here ──────────────────────────────────────
+ * `GET /api/sites` is a BFF route, and every BFF route answers an anonymous
+ * request with 401 by design (bff.ts → NoSessionError). WorkspaceProvider sits
+ * ABOVE the whole route tree, /login included, so an ungated call here fired on
+ * the sign-in page and put a guaranteed `GET /api/sites 401 (Unauthorized)` in
+ * the console of every visitor who had not signed in yet — which reads as a
+ * broken API call and is in fact the BFF working exactly as specified.
+ *
+ * The gate belongs in this hook rather than in one consumer because the rule is
+ * a property of the ENDPOINT — no session, no estate — and there is more than
+ * one caller. Passing `null` is useResource's documented way to hold a request:
+ * the effect returns early, so nothing is sent at all.
+ *
+ * `status` is resolved synchronously from the server-rendered session (see
+ * SessionProvider's `initialSession`), so this costs a signed-in user nothing —
+ * there is no 'loading' pass to wait through before the estate is requested.
  */
 export function useSites(): Resource<Site[]> {
-  return useResource(siteRepository.list());
+  const {isAuthenticated} = useSession();
+  return useResource(isAuthenticated ? siteRepository.list() : null);
 }
diff --git a/src/shared/providers/WorkspaceProvider.tsx b/src/shared/providers/WorkspaceProvider.tsx
index a6c6b0a..8352950 100644
--- a/src/shared/providers/WorkspaceProvider.tsx
+++ b/src/shared/providers/WorkspaceProvider.tsx
@@ -75,10 +75,11 @@ export function WorkspaceProvider({children}: {children: React.ReactNode}) {
    * five Bengaluru shops, which meant every scoped request in the app was
    * filtered by a store id that only existed in this file.
    *
-   * Gated on the session because this provider sits above the whole route
-   * tree, including /login: asking for the estate before anyone has signed in
-   * would put a guaranteed 401 in the console on every visit to the sign-in
-   * page.
+   * The session gate that keeps this off /login lives inside useSites, not
+   * here. It used to be written here as prose and applied only to `stores`
+   * below, so the request still went out on the sign-in page and every
+   * anonymous visitor got `GET /api/sites 401` in their console. A gate on the
+   * derived value cannot hold a fetch — only a null endpoint can.
    */
   const {status} = useSession();
   const sites = useSites();